How can internal audit better align with the organization's strategic priorities?
PEPPERS All of The IIA's recent stakeholder surveys tell us we must maintain or enhance organizational alignment to stay relevant. A practical test to ensure internal audit has the right balance is to consider how much of its risk assessment efforts are spent looking backward at past events versus looking forward at what is to come. Confirm that assurance and advisory engagements are selected to address the current objectives of the organization. Of course, that assumes you are knowledgeable about those strategic activities.
URBAN We are in a transformative age — business today is anything but usual. Strategic priorities are driving organizations more than ever to continue to protect and grow. This is where we can add tremendous value by tying our audit plans back to the organization's strategy. If our assurance and consulting work is not aligned with what's most important to the organization, we should challenge why we are doing it. If it's a regulatory or management requirement, then we should identify ways to cover those areas more efficiently so we can focus more on the risks aligned to strategic priorities.
How should internal audit adapt to meet changing expectations?
URBAN It is critical that internal audit practices and processes are flexible and able to adapt to the disruptive changes happening around us. Many internal audit functions follow prescribed practices that are carved in stone in the audit manual. This helps with consistency and quality, but it sometimes keeps auditors from exploring alternate approaches that may be more impactful or efficient for a particular risk area. Internal auditors should allocate time during the planning phase of an audit project to challenge themselves on the approach and techniques they deploy, and make innovation or continuous improvement part of the planning process.
PEPPERS We have to be in touch with those expectations. Our audit team members are the best resources to help with that. They should be encouraged to listen to our customers and come back and tell us what they hear. As a group, we can then be responsive. While adaptation and evolution are imperative, there are also fundamental principles and practices that shouldn't fluctuate wildly. So thoughtfully consider where and when to invest time and resources into change.
What will be the impact of disruptors like data analytics, artificial intelligence (AI), and blockchain?
PEPPERS I find it telling that some internal auditors still consider data analytics to be a new or recent disruptor. We've had that technology available to us for more than 20 years, and some still don't even touch it. When we think of how AI will impact our organizations in the next few years, auditors who take a similar hands-off approach will do so at their own peril. We want to be in a future position to audit these emerging technologies, so we need to be around the table as the related governance, architecture, and infrastructure decisions are being made.
URBAN These emerging technologies are disrupting long-held business norms, processes, and models. They hold the key for many organizations to drive more cost effective and reliable operations, but may be introducing risks no one has yet thought about. They also promise incredible new capabilities for auditors who understand and adopt what these new enablers can bring to the audit process. I like to think about these technologies as multipliers of audit capacity and capability — if we are brave enough to take the leap.
How can CAEs improve their relationships with the board and audit committee?
URBAN A lot of it comes down to better communication and building trust. It's easy to assume we know what our stakeholders want, or need, from internal audit — but very few of us ask directly. In our organization, we touch base with key stakeholders at least once a quarter, and not just about the status of the plan or other administrative matters. We talk about what's important to them as stakeholders, and what defines a high-quality and high-value audit service. How are we doing, and where are we missing the mark? We try to understand their personal and social style, their communication preferences, etc.
PEPPERS I think a CAE has to start by candidly acknowledging the current state of those relationships. Don't just assume all is well. A great indicator is the frequency of communication and who initiates it. Solicit sincere feedback about style and then either maintain or modify accordingly. It also is imperative that CAEs take full advantage of every opportunity they have in front of their audit committees and boards. We must creatively and effectively represent to them the full spectrum of our work and the impact we are making.
How can internal audit add value to the organization's sustainability strategy?
PEPPERS Auditors need to have a holistic, long-term view of the organization, its objectives, and its risks. This includes issues around its long-term sustainability and the resources it uses to deliver products and services to its consumers. For example, many audits focus on the process, and while many auditors may use a process mapping effort known as SIPOC [Suppliers, Inputs, Process, Outputs, and Consumers], typically not much time is spent understanding the risks associated with the supplies and inputs into the process. Who is providing the inputs? Where do they get their supply? Is there limited capacity of the supplies, or does demand outstrip supply? What would happen if that supplier could no longer deliver? This is just one path of questioning that opens up by simply looking beyond what is normally audited. There are many other possible pathways when operations are considered from a longer-term, sustainability perspective.
URBAN According to the Center for Board Matters' 2017 Proxy Season Review, fully 49 percent of all shareholder proposals are related to environmental or social issues. With such diverse topics as greenhouse gas emissions, board diversity, and environmental health and safety, many internal audit teams are finding a place for these topics in the audit plan. Internal audit can address sustainability and environmental, social, and governance issues in many ways. One way is to look at the overall governance structure of sustainability. Is it a stand-alone function that issues a report once a year, or is it integrated into the business? Does it measure and report on key metrics and have reduction targets in place? Is it led by a senior executive? Some organizations also are examining whether and how to integrate nonfinancial risk into their overall enterprise risk management process, especially in light of recent U.S. Securities and Exchange Commission and shareholder interest in these areas.
How does internal audit attract and retain the right type of talent considering these issues?
URBAN Talk about disruption! The entire business model for how candidates are sourced and from where they are sourced is changing across business. Internal audit is no exception. Organizations like ours are diving deeper into the universities to identify high-performing talent as early as freshman year to join our staff ranks. Traditional backgrounds and majors are still needed, but we are recruiting more data scientists, engineers, IT majors, and other non-accountants. Organizations are continuing to develop rotational leadership development programs that involve time in internal audit, but with the goal of building future business leaders — not future auditors.
PEPPERS Selection of the right team resources starts with a clear understanding by all of what the job entails. That clarity will increase the likelihood of the right match for the position, and job satisfaction will follow and improve retention. But that is increasingly more challenging given the dynamic nature of the environment we've been discussing. A CAE colleague recently told me she has totally revamped her recruiting to heavily weight critical thinking skills. When those are present, she finds the individuals are better able to perform, contribute, and grow over time. When that happens throughout the internal audit activity, everyone benefits.